Information Management Assessment

Progress review

Department for Transport (DfT) Contents

Background 3

Headline findings 3

Progress since the IMA 4

Next steps 7

Annex A – 2017 Recommendations 8

© Crown copyright 2019

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gov.uk Background

- The National Archives’ Information Management Assessment (IMA) programme was set up to review standards of information and records management in government organisations.

- The Department for Transport (DfT) was first assessed in 2014. The National Archives undertook an IMA reassessment in March 2017. This progress review builds on feedback given to DfT since the 2017 IMA reassessment. Arising from that reassessment were nine recommendations. This report focusses on developments under the same headings and also references progress against the recommendations. Where progress has been uprated since the 2017 IMA, this has been identified with colour. The report concludes with areas for further development.

- Note – where evidence has been provided that is relevant to the recommendations in the 2017 reassessment report, these are signposted with an ‘R’ and the corresponding recommendation number, such as ‘R2’. The subsequent number(s) refer to the department’s action plan which is published alongside this report.

Headline finding

DfT has achieved significant progress by defining key roles e.g. a Senior Knowledge and Information Management (KIM) Champion which has helped the KIM team to reach out into the organisation more widely. The KIM team have also acquired change management resource from the Digital Adoption team to help with their Information Management Modernisation (IMM) programme to assist with the behaviour change needed to make a success of that programme. Plans to improve standards of information management are fully supported at a senior level. Via the IMM programme the KIM team has overall ownership of the SharePoint online tenant (branded as TiME) rollout. The programme is being implemented gradually and is fully aligned with the associated IT led project to rollout further Office365 apps. Summary of progress since the IMA

1 The value of information

| Section | IMA 2017 | Review 2019 | |--------------------------------------|-------------------|-------------| | Communicating and realising value | Development area | Development area | | Managing information as an asset | Satisfactory | Satisfactory |

- A senior KIM Champion for information and records management has been appointed and has joined the Information Management Modernisation (IMM) programme board. (R1 1.2)

- A newly recruited Change Manager in DfT’s Digital Adoption team supports the IMM programme by measuring success in changing behaviours in the context of O365. (R3, 3.1, R1. 1.1)

- The KIM team has started to develop its strategy to improve the information management capability of the organisation. The strategy is still in draft and the KIM team is in discussion with other teams within Digital Service to ensure that the KIM strategy is aligned with other DS strategies, for example, Digital Technology Strategy.

- The KIM team now work with the Information Assurance (IA) team to identify previously unknown information assets uncovered by Business Record Officers (BROs) in their yearly compliance report. (R7 7.1)

2 Digital information and supporting technology

| Performance rating | IMA 2017 | Review 2019 | |-------------------------------------------|-------------------|-------------| | Supporting information through technology | Development area | Satisfactory | | Digital continuity and IT change | Development area | Development area |

- Analysis of files on hard drives has been carried out to identify the most vulnerable material. The KIM team is working on an action plan which will assure digital continuity of these files. • Shared drives are locked down as information is migrated into TiME. The KIM team provide ongoing management of information still present on shared drives which need to be kept in line with their retention schedules. KIM team are using tools such as Tree size Pro and AI Data Point to help analyse information held on shared drives and to create new file structures for TiME. (R4 4.3)

• In planning migration to TiME, sensitive areas were identified and restricted permissions have been assigned. To allow better access, collaboration and transparency across the department, all other information is ‘open’ by default. (R3 3.2)

• By using the in-built features of SharePoint online, DfT have been able to decommission the third party plugins in use with SharePoint on premises to utilise the use of information management tools that DfT has already invested in and increase cost efficiency. (R3)

• TiME has been rolled out to 15% - 20% of DfT staff. Planned completion date for rollout is end of March 2020. (R3)

• The Digital Adoption team provides the training for O365 tools and the KIM team makes sure the training material includes KIM content. (R6 6.4)

• Newly defined and trained Local Information Managers (LIM) are encouraged to promote behavioural change, which is a key part of the TiME role out process to new business areas. (R8 8.2)

• In the new O365 environment, in-built functionality and reporting tools will be used to monitor the information management practices of users. The KIM team is planning to look at additional tools and services including the possibility to upgrade currently used E3 licences for this purpose. The team will look at what other departments are starting to do in this space; drawing on any available advice and guidance. (R4 4.1, R5 5.3)

• DfT have procured the Automated Intelligence Sync Point plugin to integrate TiME with Outlook. This solution allows users to save and file emails more easily which is a significant improvement. However developing an email archive plan has been delayed. DfT is very similar to other departments in this respect. The issue has been highlighted in the O365 project risk register. (R1 1.3)

• There are ongoing discussions with the architecture, digital adoption and security team on identifying web based collaboration tools used by the staff outside of the corporate information management environment. DfT are aware of the risks and policy development need in this area, however the work has not started yet. (R1, 1.3, R3 3.2, R5 5.3, R6 6.4) • A Google Cloud Platform project has launched looking at the storage and management of datasets. The KIM team are working to ensure that KIM requirements are taken into account during this project. (R9 9.1)

• KIM is represented on the task and finish group led by The National Archives on Information Management best practice within O365.

3 Information risk, governance and oversight

| Performance rating | IMA 2017 | Review 2019 | |--------------------------|----------------|-------------| | Recognising information risk | Development area | Development area | | Establishing control | Satisfactory | Satisfactory | | Providing guidance | Development area | Development area | | Measuring impact | Satisfactory | Satisfactory |

• DfT has achieved significant progress by defining key roles e.g. a Senior KIM Champion and change management resource which has helped the KIM team to reach out into the organisation more widely. Plans to improve standards of information management are fully supported at a senior level. (R4 4.1, R6 6.4)

• Their new Chief Information Security Officer intends to support the SIRO's awareness of information risks. (R5 5.4)

• The KIM team has successfully collaborated with Information Assurance colleagues to ensure the GDPR compliance of information assets by identifying and mitigating the risk with the most affected areas of HR and Procurement. KIM team continue to maintain the close collaboration with the Information Rights team who have responsibility for GDPR compliance going forward. (R1 1.3, R5 5.4)

• A new digital and behavioural change focused role: Local Information Managers (LIM) and accompanying training programme have been developed to replace the BRO role. (R8 8.1, 8.2)

• User research took place in autumn 2018 among initial users to monitor user adoption of TiME including surveying the success level of migration to the new system. Findings were reported back to the IMM project board and used to improve the migration process with better understanding of business needs. The KIM team have also developed a process of surveying business areas at several points after migration to check in on adoption. (R3 3.2) • The KIM team has representation on the O365 Phase 2 project board. With the support of the Cloud Engineering and Digital Architecture teams, O365 apps are being reviewed to ensure they meet with KIM principles. (R4 4.1, R8 8.3)

• KIM team representatives continue to participate in the Better Information for Better Government information management risk tool development which has helped DfT to improve its approach in handling information management risk.

4 Records, review and transfer

| Performance rating | IMA 2017 | Review 2019 | |------------------------------------------|-------------------|----------------------| | Oversight of records and selection | Development area | Development area | | Implementing disposal decisions | Development area | Development area |

• Retention and disposal policies have been created for email, personal drives, shared drives, and corporate systems. The KIM team aims to develop an overarching policy on retention and provide guidance at the rollout of new systems.

• The TiME project motivated the KIM team to reconsider their retention and disposal practice. A paper was presented to the Digital Service Board on the retention approach.

• Digital files are being reviewed manually. Developing a more advanced process is a key objective of the KIM team. A proposed plan will need to be submitted to Executive Committee for approval.

• So far no digital records have been selected for transfer to The National Archives. (R9 9.3)

Next Steps

• Shared strategy development within Digital Services, to embed KIM principles in related implementation plans is an important goal. KIM team's effort to widen the context of KIM to DfTs entire digital, data and technology estate should be supported on senior level.

• Led by the Digital Adoption Change Manager in collaboration with KIM and the IMM project, DfT should develop a behavioural charter/strategy. • Collaborate with Digital colleagues to discover the potential of data science to improve information exploitation and to support the process of appraisal, selection and sensitivity review of digital records. For this purpose Discover potentials of Google Cloud Platform (GCP) services where DfTs legacy data is being held. Initiate cross-government discussion with other GCP users. Liaise with The National Archives in this regard.

• Review corporate information management risk profile and reflect this in appropriate risk register with defined chain of escalation.

• Produce appraisal methodology and continue dialogue about digital transfer plans with The National Archives.

• Continue active participation in O365 user and task and finish group and use their forums to collaborate with others to better exploit the capability of O365 in areas such as reporting.

• Continue engagement in risk management tool development and discuss Email Management challenges with Better Information for Better Government (BI4BG) and other cross-government forums.

• Consider DfT participation DCMS’ cross-government working group on data inventories in relation to the GCP data management and storage project.

Annex A – 2017 recommendations

• Recommendation 1 Establish a programme of work to embed the right information management culture in the new IT environment. This should be closely integrated with planned IT change.

• Recommendation 2 Establish and communicate a clear vision and strategy for information management.

• Recommendation 3 Apply continued focus to the delivery of an improved IT environment that will make good information management practice easier to achieve.

• Recommendation 4 Build on the work to embed digital continuity as part of the proposed information principles, putting in place concrete plans for KIM and IT staff to deliver digital continuity and information management priorities. • Recommendation 5 Review corporate descriptions of information and records management related risk. Ensure causes and mitigating actions reflect the wider current and future IT environment, including the planned introduction of Office 365.

• Recommendation 6 Engage with the business and establishing more concrete and tailored principles for capturing and managing information and records.

• Recommendation 7 Build on the existing information asset governance framework and seek opportunities to surface and manage information and records management-related risks to information assets.

• Recommendation 8 Strengthen arrangements for information management governance and oversight of performance in the new IT environment.

• Recommendation 9 Increase oversight of digital information and develop a process for its appraisal, selection and transfer.